Skip to main content

​
4-step methodology

Every OSINT investigation follows the same four-step sequence. Complete each step before moving to the next — skipping ahead leads to unverified results and wasted effort.
1

Define the question

Determine exactly what you want to know. A precise question scopes the investigation, prevents scope creep, and makes success measurable.
2

Identify sources

Select the data types and sources relevant to your question. Use the table below to match data types to their usual locations and recommended tools.
3

Collect

Gather data using both manual techniques and automated tools. Follow collection with immediate evidence preservation.
4

Validate and document

Corroborate findings across multiple sources. Document every piece of evidence with screenshots, cryptographic hash, capture date, URL, and an archive.org snapshot.
Never skip the validation step. A single unverified source can invalidate an entire investigation.

​
Data types, usual locations, and star tools

Data typeUsual locationStar tool
NameLinkedIn, FacebookMaigret
EmailData breaches, newslettersHIBP
PhoneWhatsApp Business, TrueCallerInfobel
UsernameForums, gaming, GitHubSnoop
PhotoGeolocation, EXIFExifTool
DomainWHOIS, certificatesAmass
IPScanning, ShodanShodan
Crypto walletBlockchain explorersBlockCypher

​
Tools mind map

The following diagram shows how the major OSINT tool categories branch from the core discipline.

​
Bellingcat methodology

The Bellingcat methodology is a six-step framework developed for open-source conflict and investigative reporting. It emphasizes preservation and verification above all else.
1

Identification

Define exactly what you are investigating. Establish the specific claim, event, or subject before any collection begins.
2

Preservation

Archive everything immediately using tools such as archive.is and the Wayback Machine. Online content disappears — preserve before you proceed.
3

Verification

Triangulate every finding with three or more independent sources. A claim supported by fewer than three sources should be treated as unconfirmed.
4

Contextualization

Build a complete chronology of events. Place your findings in their historical, geographic, and social context.
5

Documentation

Record every piece of evidence with screenshots, cryptographic hashes, and timestamps. Maintain a chain of custody for all collected material.
6

Validation

Conduct a peer review before publishing or reporting. A second investigator should be able to reproduce your findings from your documentation alone.
The Bellingcat methodology was developed for conflict open-source research and has been adopted widely across investigative journalism and threat intelligence disciplines.

​
Professional OSINT cycle (5 phases)

The professional intelligence cycle structures OSINT work from initial tasking through final delivery. It is used by intelligence analysts, corporate investigators, and law enforcement practitioners.
1

Direction

Define the intelligence requirements.
  • Define questions (RFI — Request for Intelligence)
  • Establish legal limits
  • Approve scope
2

Collection

Gather raw data from all approved sources.
  • Passive sources
  • Semi-passive sources
  • Save evidence
3

Processing

Convert raw data into usable information.
  • Normalize data
  • Translate languages
  • Structure information
4

Analysis

Derive intelligence from processed information.
  • Link analysis (Maltego)
  • Timeline creation
  • Pattern recognition
  • Cross validation
5

Dissemination

Deliver finished intelligence to the consumer.
  • Executive report
  • Technical report
  • Visual presentation
  • Evidence archive
The intelligence cycle is iterative. Dissemination often generates new questions that restart the cycle at the Direction phase.

Build docs developers (and LLMs) love

Get started for freeTalk to us